D2 Finance

D2 Finance Vault and Strategy (v2.1)via Cyfrin

Cyfrin engagement on D2 Finance, a multi-chain ETF-style vault protocol deployed across Berachain, Arbitrum, Base, and Ethereum. The audit ran from January 10 to February 14, 2025, combining manual review with stateful fuzzing across the vault, strategy, and 12 integration modules covering Aave, Camelot, Dolomite, GMX V2, 1inch, Kodiak, Pendle, Silo, Trader Joe and WETH. The review surfaced 24 findings (2 critical, 2 high, 7 medium, 7 low, 6 informational), including a broken GMX V2 withdrawal path that would have permanently locked user funds, a private key checked into the makefile, an ERC-4626 share-pricing mismatch on cross-chain transfers, and a Berachain reward-claiming interface bug. D2 resolved 19 findings and acknowledged 5. Carlos contributed to this engagement as external contractor at Cyfrin; the testimonial from Dacian on the Zealynx site references this collaboration.